]> git.zerfleddert.de Git - proxmark3-svn/blob - armsrc/lfops.c
6ac4e7251c97df16fb85bd71c2c189583686e787
[proxmark3-svn] / armsrc / lfops.c
1 //-----------------------------------------------------------------------------
2 // Miscellaneous routines for low frequency tag operations.
3 // Tags supported here so far are Texas Instruments (TI), HID
4 // Also routines for raw mode reading/simulating of LF waveform
5 //
6 //-----------------------------------------------------------------------------
7 #include <proxmark3.h>
8 #include "apps.h"
9 #include "../common/crc16.c"
10
11 void AcquireRawAdcSamples125k(BOOL at134khz)
12 {
13 if(at134khz) {
14 FpgaSendCommand(FPGA_CMD_SET_DIVISOR, 88); //134.8Khz
15 FpgaWriteConfWord(FPGA_MAJOR_MODE_LF_READER);
16 } else {
17 FpgaSendCommand(FPGA_CMD_SET_DIVISOR, 95); //125Khz
18 FpgaWriteConfWord(FPGA_MAJOR_MODE_LF_READER);
19 }
20
21 // Connect the A/D to the peak-detected low-frequency path.
22 SetAdcMuxFor(GPIO_MUXSEL_LOPKD);
23
24 // Give it a bit of time for the resonant antenna to settle.
25 SpinDelay(50);
26
27 // Now set up the SSC to get the ADC samples that are now streaming at us.
28 FpgaSetupSsc();
29
30 // Now call the acquisition routine
31 DoAcquisition125k(at134khz);
32 }
33
34 // split into two routines so we can avoid timing issues after sending commands //
35 void DoAcquisition125k(BOOL at134khz)
36 {
37 BYTE *dest = (BYTE *)BigBuf;
38 int n = sizeof(BigBuf);
39 int i;
40
41 memset(dest,0,n);
42 i = 0;
43 for(;;) {
44 if(SSC_STATUS & (SSC_STATUS_TX_READY)) {
45 SSC_TRANSMIT_HOLDING = 0x43;
46 LED_D_ON();
47 }
48 if(SSC_STATUS & (SSC_STATUS_RX_READY)) {
49 dest[i] = (BYTE)SSC_RECEIVE_HOLDING;
50 i++;
51 LED_D_OFF();
52 if(i >= n) {
53 break;
54 }
55 }
56 }
57 DbpIntegers(dest[0], dest[1], at134khz);
58 }
59
60 void ModThenAcquireRawAdcSamples125k(int delay_off,int period_0,int period_1,BYTE *command)
61 {
62 BOOL at134khz;
63
64 // see if 'h' was specified
65 if(command[strlen((char *) command) - 1] == 'h')
66 at134khz= TRUE;
67 else
68 at134khz= FALSE;
69
70 if(at134khz) {
71 FpgaSendCommand(FPGA_CMD_SET_DIVISOR, 88); //134.8Khz
72 FpgaWriteConfWord(FPGA_MAJOR_MODE_LF_READER);
73 } else {
74 FpgaSendCommand(FPGA_CMD_SET_DIVISOR, 95); //125Khz
75 FpgaWriteConfWord(FPGA_MAJOR_MODE_LF_READER);
76 }
77
78 // Give it a bit of time for the resonant antenna to settle.
79 SpinDelay(50);
80
81 // Now set up the SSC to get the ADC samples that are now streaming at us.
82 FpgaSetupSsc();
83
84 // now modulate the reader field
85 while(*command != '\0' && *command != ' ')
86 {
87 FpgaWriteConfWord(FPGA_MAJOR_MODE_OFF);
88 LED_D_OFF();
89 SpinDelayUs(delay_off);
90 if(at134khz) {
91 FpgaSendCommand(FPGA_CMD_SET_DIVISOR, 88); //134.8Khz
92 FpgaWriteConfWord(FPGA_MAJOR_MODE_LF_READER);
93 } else {
94 FpgaSendCommand(FPGA_CMD_SET_DIVISOR, 95); //125Khz
95 FpgaWriteConfWord(FPGA_MAJOR_MODE_LF_READER);
96 }
97 LED_D_ON();
98 if(*(command++) == '0')
99 SpinDelayUs(period_0);
100 else
101 SpinDelayUs(period_1);
102 }
103 FpgaWriteConfWord(FPGA_MAJOR_MODE_OFF);
104 LED_D_OFF();
105 SpinDelayUs(delay_off);
106 if(at134khz) {
107 FpgaSendCommand(FPGA_CMD_SET_DIVISOR, 88); //134.8Khz
108 FpgaWriteConfWord(FPGA_MAJOR_MODE_LF_READER);
109 } else {
110 FpgaSendCommand(FPGA_CMD_SET_DIVISOR, 95); //125Khz
111 FpgaWriteConfWord(FPGA_MAJOR_MODE_LF_READER);
112 }
113
114 // now do the read
115 DoAcquisition125k(at134khz);
116 }
117
118 void AcquireTiType(void)
119 {
120 int i;
121 // tag transmission is <20ms, sampling at 2M gives us 40K samples max
122 // each sample is 1 bit stuffed into a DWORD so we need 1250 DWORDS
123 int n = 1250;
124
125 // clear buffer
126 DbpIntegers((DWORD)BigBuf, sizeof(BigBuf), 0x12345678);
127 memset(BigBuf,0,sizeof(BigBuf));
128
129 // Set up the synchronous serial port
130 PIO_DISABLE = (1<<GPIO_SSC_DIN);
131 PIO_PERIPHERAL_A_SEL = (1<<GPIO_SSC_DIN);
132
133 // steal this pin from the SSP and use it to control the modulation
134 PIO_ENABLE = (1<<GPIO_SSC_DOUT);
135 PIO_OUTPUT_ENABLE = (1<<GPIO_SSC_DOUT);
136
137 SSC_CONTROL = SSC_CONTROL_RESET;
138 SSC_CONTROL = SSC_CONTROL_RX_ENABLE | SSC_CONTROL_TX_ENABLE;
139
140 // Sample at 2 Mbit/s, so TI tags are 16.2 vs. 14.9 clocks long
141 // 48/2 = 24 MHz clock must be divided by 12
142 SSC_CLOCK_DIVISOR = 12;
143
144 SSC_RECEIVE_CLOCK_MODE = SSC_CLOCK_MODE_SELECT(0);
145 SSC_RECEIVE_FRAME_MODE = SSC_FRAME_MODE_BITS_IN_WORD(32) | SSC_FRAME_MODE_MSB_FIRST;
146 SSC_TRANSMIT_CLOCK_MODE = 0;
147 SSC_TRANSMIT_FRAME_MODE = 0;
148
149 LED_D_ON();
150
151 // modulate antenna
152 PIO_OUTPUT_DATA_SET = (1<<GPIO_SSC_DOUT);
153
154 // Charge TI tag for 50ms.
155 SpinDelay(50);
156
157 // stop modulating antenna and listen
158 PIO_OUTPUT_DATA_CLEAR = (1<<GPIO_SSC_DOUT);
159
160 LED_D_OFF();
161
162 i = 0;
163 for(;;) {
164 if(SSC_STATUS & SSC_STATUS_RX_READY) {
165 BigBuf[i] = SSC_RECEIVE_HOLDING; // store 32 bit values in buffer
166 i++; if(i >= n) return;
167 }
168 WDT_HIT();
169 }
170
171 // return stolen pin to SSP
172 PIO_DISABLE = (1<<GPIO_SSC_DOUT);
173 PIO_PERIPHERAL_A_SEL = (1<<GPIO_SSC_DIN) | (1<<GPIO_SSC_DOUT);
174 }
175
176 void ReadTItag()
177 {
178 }
179
180 void WriteTIbyte(BYTE b)
181 {
182 int i = 0;
183
184 // modulate 8 bits out to the antenna
185 for (i=0; i<8; i++)
186 {
187 if (b&(1<<i)) {
188 // stop modulating antenna
189 PIO_OUTPUT_DATA_CLEAR = (1<<GPIO_SSC_DOUT);
190 SpinDelayUs(1000);
191 // modulate antenna
192 PIO_OUTPUT_DATA_SET = (1<<GPIO_SSC_DOUT);
193 SpinDelayUs(1000);
194 } else {
195 // stop modulating antenna
196 PIO_OUTPUT_DATA_CLEAR = (1<<GPIO_SSC_DOUT);
197 SpinDelayUs(300);
198 // modulate antenna
199 PIO_OUTPUT_DATA_SET = (1<<GPIO_SSC_DOUT);
200 SpinDelayUs(1700);
201 }
202 }
203 }
204
205 void AcquireRawBitsTI(void)
206 {
207 // TI tags charge at 134.2Khz
208 FpgaSendCommand(FPGA_CMD_SET_DIVISOR, 88); //134.8Khz
209
210 // Place FPGA in passthrough mode, in this mode the CROSS_LO line
211 // connects to SSP_DIN and the SSP_DOUT logic level controls
212 // whether we're modulating the antenna (high)
213 // or listening to the antenna (low)
214 FpgaWriteConfWord(FPGA_MAJOR_MODE_LF_PASSTHRU);
215
216 // get TI tag data into the buffer
217 AcquireTiType();
218
219 FpgaWriteConfWord(FPGA_MAJOR_MODE_OFF);
220 }
221
222 // arguments: 64bit data split into 32bit idhi:idlo and optional 16bit crc
223 // if crc provided, it will be written with the data verbatim (even if bogus)
224 // if not provided a valid crc will be computed from the data and written.
225 void WriteTItag(DWORD idhi, DWORD idlo, WORD crc)
226 {
227
228 // WARNING the order of the bytes in which we calc crc below needs checking
229 // i'm 99% sure the crc algorithm is correct, but it may need to eat the
230 // bytes in reverse or something
231
232 if(crc == 0) {
233 crc = update_crc16(crc, (idlo)&0xff);
234 crc = update_crc16(crc, (idlo>>8)&0xff);
235 crc = update_crc16(crc, (idlo>>16)&0xff);
236 crc = update_crc16(crc, (idlo>>24)&0xff);
237 crc = update_crc16(crc, (idhi)&0xff);
238 crc = update_crc16(crc, (idhi>>8)&0xff);
239 crc = update_crc16(crc, (idhi>>16)&0xff);
240 crc = update_crc16(crc, (idhi>>24)&0xff);
241 }
242 DbpString("Writing the following data to tag:");
243 DbpIntegers(idhi, idlo, crc);
244
245 // TI tags charge at 134.2Khz
246 FpgaSendCommand(FPGA_CMD_SET_DIVISOR, 88); //134.8Khz
247 // Place FPGA in passthrough mode, in this mode the CROSS_LO line
248 // connects to SSP_DIN and the SSP_DOUT logic level controls
249 // whether we're modulating the antenna (high)
250 // or listening to the antenna (low)
251 FpgaWriteConfWord(FPGA_MAJOR_MODE_LF_PASSTHRU);
252 LED_A_ON();
253
254 // steal this pin from the SSP and use it to control the modulation
255 PIO_ENABLE = (1<<GPIO_SSC_DOUT);
256 PIO_OUTPUT_ENABLE = (1<<GPIO_SSC_DOUT);
257
258 // writing algorithm:
259 // a high bit consists of a field off for 1ms and field on for 1ms
260 // a low bit consists of a field off for 0.3ms and field on for 1.7ms
261 // initiate a charge time of 50ms (field on) then immediately start writing bits
262 // start by writing 0xBB (keyword) and 0xEB (password)
263 // then write 80 bits of data (or 64 bit data + 16 bit crc if you prefer)
264 // finally end with 0x0300 (write frame)
265 // all data is sent lsb firts
266 // finish with 15ms programming time
267
268 // modulate antenna
269 PIO_OUTPUT_DATA_SET = (1<<GPIO_SSC_DOUT);
270 SpinDelay(50); // charge time
271
272 WriteTIbyte(0xbb); // keyword
273 WriteTIbyte(0xeb); // password
274 WriteTIbyte( (idlo )&0xff );
275 WriteTIbyte( (idlo>>8 )&0xff );
276 WriteTIbyte( (idlo>>16)&0xff );
277 WriteTIbyte( (idlo>>24)&0xff );
278 WriteTIbyte( (idhi )&0xff );
279 WriteTIbyte( (idhi>>8 )&0xff );
280 WriteTIbyte( (idhi>>16)&0xff );
281 WriteTIbyte( (idhi>>24)&0xff ); // data hi to lo
282 WriteTIbyte( (crc )&0xff ); // crc lo
283 WriteTIbyte( (crc>>8 )&0xff ); // crc hi
284 WriteTIbyte(0x00); // write frame lo
285 WriteTIbyte(0x03); // write frame hi
286 PIO_OUTPUT_DATA_SET = (1<<GPIO_SSC_DOUT);
287 SpinDelay(50); // programming time
288
289 LED_A_OFF();
290
291 // get TI tag data into the buffer
292 AcquireTiType();
293
294 FpgaWriteConfWord(FPGA_MAJOR_MODE_OFF);
295 DbpString("Now use tibits and tidemod");
296 }
297
298 void SimulateTagLowFrequency(int period, int ledcontrol)
299 {
300 int i;
301 BYTE *tab = (BYTE *)BigBuf;
302
303 FpgaWriteConfWord(FPGA_MAJOR_MODE_LF_SIMULATOR);
304
305 PIO_ENABLE = (1 << GPIO_SSC_DOUT) | (1 << GPIO_SSC_CLK);
306
307 PIO_OUTPUT_ENABLE = (1 << GPIO_SSC_DOUT);
308 PIO_OUTPUT_DISABLE = (1 << GPIO_SSC_CLK);
309
310 #define SHORT_COIL() LOW(GPIO_SSC_DOUT)
311 #define OPEN_COIL() HIGH(GPIO_SSC_DOUT)
312
313 i = 0;
314 for(;;) {
315 while(!(PIO_PIN_DATA_STATUS & (1<<GPIO_SSC_CLK))) {
316 if(BUTTON_PRESS()) {
317 DbpString("Stopped");
318 return;
319 }
320 WDT_HIT();
321 }
322
323 if (ledcontrol)
324 LED_D_ON();
325
326 if(tab[i])
327 OPEN_COIL();
328 else
329 SHORT_COIL();
330
331 if (ledcontrol)
332 LED_D_OFF();
333
334 while(PIO_PIN_DATA_STATUS & (1<<GPIO_SSC_CLK)) {
335 if(BUTTON_PRESS()) {
336 DbpString("Stopped");
337 return;
338 }
339 WDT_HIT();
340 }
341
342 i++;
343 if(i == period) i = 0;
344 }
345 }
346
347 // compose fc/8 fc/10 waveform
348 static void fc(int c, int *n) {
349 BYTE *dest = (BYTE *)BigBuf;
350 int idx;
351
352 // for when we want an fc8 pattern every 4 logical bits
353 if(c==0) {
354 dest[((*n)++)]=1;
355 dest[((*n)++)]=1;
356 dest[((*n)++)]=0;
357 dest[((*n)++)]=0;
358 dest[((*n)++)]=0;
359 dest[((*n)++)]=0;
360 dest[((*n)++)]=0;
361 dest[((*n)++)]=0;
362 }
363 // an fc/8 encoded bit is a bit pattern of 11000000 x6 = 48 samples
364 if(c==8) {
365 for (idx=0; idx<6; idx++) {
366 dest[((*n)++)]=1;
367 dest[((*n)++)]=1;
368 dest[((*n)++)]=0;
369 dest[((*n)++)]=0;
370 dest[((*n)++)]=0;
371 dest[((*n)++)]=0;
372 dest[((*n)++)]=0;
373 dest[((*n)++)]=0;
374 }
375 }
376
377 // an fc/10 encoded bit is a bit pattern of 1110000000 x5 = 50 samples
378 if(c==10) {
379 for (idx=0; idx<5; idx++) {
380 dest[((*n)++)]=1;
381 dest[((*n)++)]=1;
382 dest[((*n)++)]=1;
383 dest[((*n)++)]=0;
384 dest[((*n)++)]=0;
385 dest[((*n)++)]=0;
386 dest[((*n)++)]=0;
387 dest[((*n)++)]=0;
388 dest[((*n)++)]=0;
389 dest[((*n)++)]=0;
390 }
391 }
392 }
393
394 // prepare a waveform pattern in the buffer based on the ID given then
395 // simulate a HID tag until the button is pressed
396 void CmdHIDsimTAG(int hi, int lo, int ledcontrol)
397 {
398 int n=0, i=0;
399 /*
400 HID tag bitstream format
401 The tag contains a 44bit unique code. This is sent out MSB first in sets of 4 bits
402 A 1 bit is represented as 6 fc8 and 5 fc10 patterns
403 A 0 bit is represented as 5 fc10 and 6 fc8 patterns
404 A fc8 is inserted before every 4 bits
405 A special start of frame pattern is used consisting a0b0 where a and b are neither 0
406 nor 1 bits, they are special patterns (a = set of 12 fc8 and b = set of 10 fc10)
407 */
408
409 if (hi>0xFFF) {
410 DbpString("Tags can only have 44 bits.");
411 return;
412 }
413 fc(0,&n);
414 // special start of frame marker containing invalid bit sequences
415 fc(8, &n); fc(8, &n); // invalid
416 fc(8, &n); fc(10, &n); // logical 0
417 fc(10, &n); fc(10, &n); // invalid
418 fc(8, &n); fc(10, &n); // logical 0
419
420 WDT_HIT();
421 // manchester encode bits 43 to 32
422 for (i=11; i>=0; i--) {
423 if ((i%4)==3) fc(0,&n);
424 if ((hi>>i)&1) {
425 fc(10, &n); fc(8, &n); // low-high transition
426 } else {
427 fc(8, &n); fc(10, &n); // high-low transition
428 }
429 }
430
431 WDT_HIT();
432 // manchester encode bits 31 to 0
433 for (i=31; i>=0; i--) {
434 if ((i%4)==3) fc(0,&n);
435 if ((lo>>i)&1) {
436 fc(10, &n); fc(8, &n); // low-high transition
437 } else {
438 fc(8, &n); fc(10, &n); // high-low transition
439 }
440 }
441
442 if (ledcontrol)
443 LED_A_ON();
444 SimulateTagLowFrequency(n, ledcontrol);
445
446 if (ledcontrol)
447 LED_A_OFF();
448 }
449
450
451 // loop to capture raw HID waveform then FSK demodulate the TAG ID from it
452 void CmdHIDdemodFSK(int findone, int *high, int *low, int ledcontrol)
453 {
454 BYTE *dest = (BYTE *)BigBuf;
455 int m=0, n=0, i=0, idx=0, found=0, lastval=0;
456 DWORD hi=0, lo=0;
457
458 FpgaSendCommand(FPGA_CMD_SET_DIVISOR, 95); //125Khz
459 FpgaWriteConfWord(FPGA_MAJOR_MODE_LF_READER);
460
461 // Connect the A/D to the peak-detected low-frequency path.
462 SetAdcMuxFor(GPIO_MUXSEL_LOPKD);
463
464 // Give it a bit of time for the resonant antenna to settle.
465 SpinDelay(50);
466
467 // Now set up the SSC to get the ADC samples that are now streaming at us.
468 FpgaSetupSsc();
469
470 for(;;) {
471 WDT_HIT();
472 if (ledcontrol)
473 LED_A_ON();
474 if(BUTTON_PRESS()) {
475 DbpString("Stopped");
476 if (ledcontrol)
477 LED_A_OFF();
478 return;
479 }
480
481 i = 0;
482 m = sizeof(BigBuf);
483 memset(dest,128,m);
484 for(;;) {
485 if(SSC_STATUS & (SSC_STATUS_TX_READY)) {
486 SSC_TRANSMIT_HOLDING = 0x43;
487 if (ledcontrol)
488 LED_D_ON();
489 }
490 if(SSC_STATUS & (SSC_STATUS_RX_READY)) {
491 dest[i] = (BYTE)SSC_RECEIVE_HOLDING;
492 // we don't care about actual value, only if it's more or less than a
493 // threshold essentially we capture zero crossings for later analysis
494 if(dest[i] < 127) dest[i] = 0; else dest[i] = 1;
495 i++;
496 if (ledcontrol)
497 LED_D_OFF();
498 if(i >= m) {
499 break;
500 }
501 }
502 }
503
504 // FSK demodulator
505
506 // sync to first lo-hi transition
507 for( idx=1; idx<m; idx++) {
508 if (dest[idx-1]<dest[idx])
509 lastval=idx;
510 break;
511 }
512 WDT_HIT();
513
514 // count cycles between consecutive lo-hi transitions, there should be either 8 (fc/8)
515 // or 10 (fc/10) cycles but in practice due to noise etc we may end up with with anywhere
516 // between 7 to 11 cycles so fuzz it by treat anything <9 as 8 and anything else as 10
517 for( i=0; idx<m; idx++) {
518 if (dest[idx-1]<dest[idx]) {
519 dest[i]=idx-lastval;
520 if (dest[i] <= 8) {
521 dest[i]=1;
522 } else {
523 dest[i]=0;
524 }
525
526 lastval=idx;
527 i++;
528 }
529 }
530 m=i;
531 WDT_HIT();
532
533 // we now have a set of cycle counts, loop over previous results and aggregate data into bit patterns
534 lastval=dest[0];
535 idx=0;
536 i=0;
537 n=0;
538 for( idx=0; idx<m; idx++) {
539 if (dest[idx]==lastval) {
540 n++;
541 } else {
542 // a bit time is five fc/10 or six fc/8 cycles so figure out how many bits a pattern width represents,
543 // an extra fc/8 pattern preceeds every 4 bits (about 200 cycles) just to complicate things but it gets
544 // swallowed up by rounding
545 // expected results are 1 or 2 bits, any more and it's an invalid manchester encoding
546 // special start of frame markers use invalid manchester states (no transitions) by using sequences
547 // like 111000
548 if (dest[idx-1]) {
549 n=(n+1)/6; // fc/8 in sets of 6
550 } else {
551 n=(n+1)/5; // fc/10 in sets of 5
552 }
553 switch (n) { // stuff appropriate bits in buffer
554 case 0:
555 case 1: // one bit
556 dest[i++]=dest[idx-1];
557 break;
558 case 2: // two bits
559 dest[i++]=dest[idx-1];
560 dest[i++]=dest[idx-1];
561 break;
562 case 3: // 3 bit start of frame markers
563 dest[i++]=dest[idx-1];
564 dest[i++]=dest[idx-1];
565 dest[i++]=dest[idx-1];
566 break;
567 // When a logic 0 is immediately followed by the start of the next transmisson
568 // (special pattern) a pattern of 4 bit duration lengths is created.
569 case 4:
570 dest[i++]=dest[idx-1];
571 dest[i++]=dest[idx-1];
572 dest[i++]=dest[idx-1];
573 dest[i++]=dest[idx-1];
574 break;
575 default: // this shouldn't happen, don't stuff any bits
576 break;
577 }
578 n=0;
579 lastval=dest[idx];
580 }
581 }
582 m=i;
583 WDT_HIT();
584
585 // final loop, go over previously decoded manchester data and decode into usable tag ID
586 // 111000 bit pattern represent start of frame, 01 pattern represents a 1 and 10 represents a 0
587 for( idx=0; idx<m-6; idx++) {
588 // search for a start of frame marker
589 if ( dest[idx] && dest[idx+1] && dest[idx+2] && (!dest[idx+3]) && (!dest[idx+4]) && (!dest[idx+5]) )
590 {
591 found=1;
592 idx+=6;
593 if (found && (hi|lo)) {
594 DbpString("TAG ID");
595 DbpIntegers(hi, lo, (lo>>1)&0xffff);
596 /* if we're only looking for one tag */
597 if (findone)
598 {
599 *high = hi;
600 *low = lo;
601 return;
602 }
603 hi=0;
604 lo=0;
605 found=0;
606 }
607 }
608 if (found) {
609 if (dest[idx] && (!dest[idx+1]) ) {
610 hi=(hi<<1)|(lo>>31);
611 lo=(lo<<1)|0;
612 } else if ( (!dest[idx]) && dest[idx+1]) {
613 hi=(hi<<1)|(lo>>31);
614 lo=(lo<<1)|1;
615 } else {
616 found=0;
617 hi=0;
618 lo=0;
619 }
620 idx++;
621 }
622 if ( dest[idx] && dest[idx+1] && dest[idx+2] && (!dest[idx+3]) && (!dest[idx+4]) && (!dest[idx+5]) )
623 {
624 found=1;
625 idx+=6;
626 if (found && (hi|lo)) {
627 DbpString("TAG ID");
628 DbpIntegers(hi, lo, (lo>>1)&0xffff);
629 /* if we're only looking for one tag */
630 if (findone)
631 {
632 *high = hi;
633 *low = lo;
634 return;
635 }
636 hi=0;
637 lo=0;
638 found=0;
639 }
640 }
641 }
642 WDT_HIT();
643 }
644 }
Impressum, Datenschutz